I’ve received a lot of tweets today regarding changes to Evernote’s privacy policy that go into effect on January 23, 2017. One of the biggest changes is that the latest update allows some Evernote employees to “exercise oversight of machine learning technologies applied to account content.”

My reading of this is that Evernote is allowing a limited number of employees access to users data for the purpose of checking up on and improving the machine learning process. Evernote says these employees will be subject to strict rules and training to protect user information, but it’s still a little jarring.

Evernote’s Privacy policy already lists limited circumstances in which they may review or access user account information, which include:

We believe our Terms of Service has been violated and confirmation is required or we otherwise have an obligation to review your account Content as described in our Terms of Service;

We need to do so for troubleshooting purposes or to maintain and improve the Service;

Where necessary to protect the rights, property or personal safety of Evernote and its users (including to protect against potential spam, malware or other security concerns); or

In order to comply with our legal obligations, such as responding to warrants, court orders or other legal process. We vigilantly protect the privacy of your account Content and, whenever we determine it possible, we provide you with notice if we believe we are compelled to comply with a third party’s request for information about your account. Please visit our Information for Authorities page for more information.

To be clear, Evernote is not unique here. Just about all cloud services have access to user data. Unless a service provides for complete encryption of data where only the user holds the key, the data is accessible to the provider, certain employees and subject to subpoena. Data stored unencrypted in a cloud service has the potential to be read, exposed or shared without the user’s knowledge or permission. We all have to be diligent about what we store in the cloud, the providers we use and the policies they implement.

Evernote offers the option to opt out of machine learning technologies, thus limiting this vector for employee access by deselecting the “Allow Evernote to use my data to improve my experience" option in your account settings. However, a user cannot opt out of employees looking at their content for other reasons outlined in their privacy policy.

I’m not thrilled about this change to Evernote’s policy but I’m also trying not to be reactionary. Evernote employees already had the ability to access my data, now they just have another reason to do so. However, this change comes at a time when I’m already reevaluating my use of the service and actively puling certain types of data out of Evernote.

By the way, the next Mac Power Users will be all about Devon Think. Interesting timing.

Update: Evernote CEO Chris O'Neill has issued another post attempting to better explain the company's privacy policy changes and the limited access employees have to data.